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ABSTRACT 

Can improved environmental testing prevent on-orbit component failures such as those 
experienced in the Tracking and Data Relay Satellite (TDRS) constellation? TDRS 
communications have been available to user spacecraft continuously for over 11 years, during 
which the five TDRSs placed in orbit have demonstrated their redundancies and robustness by 
surviving 26 component failures. Nevertheless, additional environmental testing prior to launch 
could prevent the occurrence of some types of failures, and could help to maintain 
communication services. Specific testing challenges involve traveling wave tube assemblies 
(TWTAs) whose lives may decrease with on-off cycling, and heaters that are subject to thermal 
cycles. The development of test conditions and procedures should account for known thermal 
variations. Testing may also have the potential to prevent failures in which components such as 
diplexers have had their lives dramatically shortened because of particle migration in a 
weightless environment. Reliability modeling could be used to select additional components that 
could benefit from special testing, but experience shows that this approach has serious 
limitations. Through knowledge of on-orbit experience, and with advances in testing, 
communication satellite programs might avoid the occurrence of some types of failures, and 
extend future spacecraft longevity beyond the current TDRS design life of ten years. However, 
determining which components to test, and how much testing to do, remain problematical. 


INTRODUCTION 

The NASA Space Network 

The NASA Space Network includes five geostationary TDRSs controlled by ground 
terminals located primarily at White Sands, New Mexico. The TDRSs, from their high orbits, can 
view almost the entire surface of Earth. Each TDRS relays commands from a ground terminal to 
user spacecraft in low earth orbit (LEO). Each TDRS also relays data and telemetry from user 
spacecraft to the ground terminal. User spacecraft benefit from the Space Network's ability to 
communicate between fixed ground facilities and rapidly-moving spacecraft at almost any time, 
and at almost any location in LEO. Some examples of user spacecraft are included in Table 1. 


*Work performed by The MITRE Corporation for the National Aeronautics and Space Administration, 
Goddard Space Flight Center, Code 405 under Contract NAS5-32607. 
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Table 1. Examples of TDRS User Spacecraft 


Advanced X-Ray Astrophysics Facility (AXAF) 
Cosmic Background Explorer (COBE) 

Earth Observing System (EOS) 

Earth Radiation Budget Satellite (ERBS) 

Extreme Ultraviolet Explorer (EUVE) 

Gamma Ray Observatory (GRO) 

Hubbell Space Telescope (HST) 

Landsats (LSATs) 

Ocean Topography Experiment (TOPEX) 

Space Shuttle Orbiters Atlantis, Columbia, 
Discovery, and Endeavour 
Space Station Alpha (SSA) 

Tropical Rainfall Measurement Mission (TRMM) 
Upper Atmospheric Research Satellite (UARS) 
X-Ray Timing Explorer (XTE) 


Replenishment and Reliability 

To ensure the continuity of Space Network services, NASA monitors the state of health of 
the TDRSs, plans for changes in user requirements, and replaces or supplements TDRSs as 
necessary. Constellation replenishment planning depends on accurate estimates of TDRS lives. 
TDRS lives are predicted by reliability models. These models perform Monte Carlo simulations 
of the failures of all components except those already known to have failed. In most cases, a 
TDRS has a primary and a back-up component for each required function. Thus, most 
component failures do not prevent a TDRS from performing its mission. A partial or complete 
communication failure occurs only if both a primary component and its back-up components fail. 


COMPONENT FAILURE HISTORY 
Predicted Failures 

Failure predictions are based on the "parts count" method and a constant failure rate for 
each class of part in operation, i.e., whose failure would be observable from the relayed data or 
from telemetry. Predictions are made using random or pseudo-random number generators to 
reflect the uncertainty of future events - even though the events may ultimately be physically 
explainable and thus non-random. Predicted failure rates are based on MIL-HDBK 217D (ref. 1). 
The "reliability drivers" are the components that most significantly affect the reliability of a 
TDRS's communication service, based on their predicted failure rates considered in combination 
with their duty cycles and the availability of back-up components. These reliability drivers are 
listed in Table 2. 
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Table 2. TDRS Reliability Drivers 


Component 

Ten-Year Reliability 

Decrypter 

0.81 

Return Processor 

0.89 

TT&C Transponder 

0.93 

Encrypter 

0.94 

Forward Processor 

0.94 

Traveling Wave Tube Amplifier Assemblies 

0.94 

Master Frequency Generator 

0.95 

Multiple Access Transmitter 

0.96 

Multiple Access Receiver 

0.97 

Ku-Band Receivers 

0.98 

Solar Array Drive Assembly 

0.99 

Telemetry Unit 

0.99 

Thruster Module 

0.99 

Wheel Drive Assembly 

0.99 

All Others 

0.91 

All 

0.42 


The total predicted component failure rate of 1.10 per TDRS per year is constant for any 
TDRS except for the usually minor decreases that occur after a primary component and its back- 
up both fail, or if there is a single-point failure (one with no design back-up). TDRS 6's predicted 
failure rate is slightly lower than the rate for the earlier TDRSs because of the substitution of 
higher-reliability low noise amplifiers for the previously used parametric amplifiers in the single- 
access return telecommunication chains (ref. 2). The TDRS 7 failure rate will be even lower 
because its single-access services will use solid state power amplifiers (SSPAs) instead of TWTAs 
(ref. 3). 


The total predicted failure rate of the TDRS constellation is approximately proportional to 
the number of TDRSs on orbit. Therefore, the total predicted failure rate for the constellation 
increased with each successfully launched TDRS. Depending on the future survival and 
operation of older TDRSs, the total predicted failure rate of the constellation may continue to 
increase. The TDRS launch dates and current ages are shown in Table 3. 


Table 3. TDRS Launch Dates and Ages (as of July 1, 1994) 


Satellite 
TDRS 1 
TDRS 2 
TDRS 3 
TDRS 4 
TDRS 5 
TDRS 6 
TDRS 7 

TDRS 8, 9, and 10 


Launch Date 
April 4, 1983 
January 1985 
September 29, 1988 
March 13, 1989 
August 2, 1991 
January 13, 1993 
June 29, 1995 (planned) 
Unscheduled 


A ge in Years 
11.24 

Launch failed 
5.75 
5.30 
2.91 
1.46 

Unlaunched 

Unlaunched 
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Observed Failures 


The component failures considered in this paper include those that appear to reflect 
imperfections in the design, manufacturing, or operation of a TDRS in the space environment, 
and that would be expected to significantly and irreversibly impair TDRS communication service 
in the absence of back-ups or a prior failure of the service. The failures on TDRS 1 of the primary 
thruster bank and the back-up negative roll thruster, which appear to have resulted from 
problems at launch with the booster rocket, and the failure of TDRS 2 to be carried into orbit by 
Challenger, are not counted for the purposes of this paper. Also not counted are failures that 
would affect the non-Space Network equipment on board, which is neither modeled nor fully 
monitored. 

A TDRS can be neither inspected in orbit nor returned to earth for study. The state of 
health of a TDRS is surmised based on telemetry and the quality of communication services. The 
compilation of a component failure list is subjective, and opinions about whether a component 
has failed, and when it failed, may differ. More than one hundred Spacecraft Orbital Anomaly 
Reports (SOARs) document events that are not considered to be failures as defined in this paper, 
and it is possible and perhaps likely that some component failures have not been detected. Also, 
the attribution of a failure to a specific component may differ depending on whether the 
component caused the failure or was affected by the failure. In this paper, the affected 
component, which appears to have its function impaired or absent, is the one that is named. The 
cause of the failure is often less certain. The failures are listed in Table 4. 


Table 4. TDRS Component Failure History 


Pate 

Component Description TDRS 

Agemi 

SO; 

07-17-83 

Gyro (# 1/2) 

i 

0.28 

1 

10-19-83 

Diplexer, Ku-Band Forward East 

i 

0.54 

7 

10-28-83 

TWTA, Ku-Band East , Primary 

i 

0.57 

7 

11-01-83 

TWTA, Ku-Band West, Primary 

i 

0.58 

8 

04-15-85 

TWTA, Ku-Band Downlink, Primary (#5) 

i 

2.03 

43 

06-27-85 

Indicator, East Pitch, Primary 

i 

2.23 

55 

04-02-86 

Heater (at parametric amplifier), East, Primary 

i 

3.00 

61 

11-28-86 

Diplexer, S-Band Forward East 

i 

3.65 

64 

08-08-87 

TWTA, S-Band East, Primary 

i 

4.34 

67 

08-11-87 

TWTA, S-Band East, Redundant 

i 

4.35 

68 

03-14-89 

Indicator, West Pitch, Primary 

4 

0.00 

86 

07-05-89 

Phased Array Receiver, S-Band, Primary (#10) 

1 

6.25 

93 

08-30-89 

Synthesizer, S-Band Return East, Primary 

1 

6.41 

96 

09-28-89 

Indicator, East Pitch, Redundant 

1 

6.49 

97 

11-11-89 

TWTA, Ku-Band Downlink, Primary (#4) 

1 

6.61 

95 

01-16-90 

Switch, West Polarization 

3 

1.30 

100 

04-03-90 

TWTA, Ku-Band East, Redundant 

1 

7.00 

102 

08-07-90 

Indicator, West Pitch, Redundant 

4 

1.40 

108 

04-09-91 

Earth Sensor Electronics, Primary 

4 

2.07 

111 

07-05-91 

Master Frequency Generator, 955 MHz, Primary 4 

2.31 

115 

09-04-91 

Processor (?), S-Band Return East, Primary 

1 

8.42 

119 

04-03-92 

TWTA, Ku-Band West, Redundant 

1 

9.00 

125 

05-29-92 

Heater (at parametric amplifier), East, Primary 

4 

3.21 

131 

01-13-93 

Thermistor (on solar array) 

6 

0.00 

138 

08-31-93 

TWTA, Ku-Band Downlink, Redundant (#6) 

1 

10.41 

122 

05-29-94 

TWTA, S-Band East, Primary 

5 

2.82 

161 


214 



The reader will notice that 18 of the 26 failures have occurred on TORS 1 during its 11 years of 
service. Only one failure has occurred on the almost six-year-old TORS 3. With five failures in its 
five years, TORS 4 has an average history. TORS 5 has had only one failure in almost three years, 
and TORS 6 has one failure in a year and a half. 

TORS 1 failures are dominant, leading most program personnel to conclude that 
subsequent improvements in design, manufacturing, and testing have markedly lowered the 
failure rates of the later TDRSs. However, the data base is not sufficient to justify such a 
conclusion on a purely statistical basis. The ages of the components when they failed are neither 
predominantly low, indicative of "infant mortality," nor predominantly high, indicative of 
burnout or wearout, but are distributed more or less evenly. Most of the failures are attributed to 
design errors, manufacturing defects, and unknown but often recurring conditions, with few if 
any being random events. 

Observations Versus Predictions 

A historical comparison of the numbers of predicted and observed TORS component 
failures is shown in Figure 1. Since the prediction is an expected value, it increases smoothly, 
while the observations can occur as only discrete integral values. The 95% upper and lower 
confidence limits are calculated above and below the predictions, based on binomial probabilities, 
to delineate a confidence zone. 



Figure 1. TDRS Component Failures to July 1, 1994 


The observations tend to exceed predictions early in the program because many 
component failures occurred on the first TORS. Recently, the observations fell behind predictions 
because of the better performance of the later TDRSs. Overall, the entire history of the TDRS 1 
through TORS 6 procurement appears to agree with predictions as well as can be expected. 
Future observations may fall further behind predictions. However, this trend could be halted by 
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either premature burnout or wearout on TDRS 1 through TDRS 6, or failures of new design 
features or part lots used beginning with TDRS 7. 

The observed agreement is not entirely fortuitous. Three different sets of failure rates 
have been compiled for the TDRS design. The earliest set, based on MIL-HDBK 217B, included 
relatively high failure rates, and was replaced by MIL-HDBK 217D rates (refs. 4 and 5). The 
latter were considered to be a priori more appropriate, based on spacecraft experience in general 
but not on TDRS experience, which was then very limited and not yet fully compiled and 
analyzed. When the even lower MIL-HDBK 217E Notice 1 rates became available, they were 
found to under-predict historical TDRS failures, and thus they were not adopted for use in 
reliability and replenishment modeling (ref. 6). The most recently tabulated failure rates, in MIL- 
HDBK 21 7F Notice 1, have not been applied to the TDRS design, but could have been if a change 
to the new rates had been deemed necessary (ref. 7). In short, MIL-HDBK 21 7D failure rates have 
been used because they are consistent with total component failure experience. 

For individual categories of components, observations do not mirror predictions. For 
example, the total predicted failure rate of 1.10 components per year is the sum of the rates for the 
TDRS bus and payload. The bus includes subsystems such as attitude control, electric power, 
propulsion, tracking, telemetry, and command (TT&C), and thermal control for these subsystems, 
with a total predicted failure rate of 0.44 components per year. The telecommunications payload 
has a total predicted failure rate of 0.66 components per year. However, only three of the 26 
components failed to date are in the bus (viz., a gyro, an earth sensor, and a solar array 
thermistor). The reason for the better reliability of the TDRS bus is believed to be that its design 
was previously developed, tested, and improved by the Navy's FLTSATCOM program, while the 
TDRS payload design represented an extension of existing technology. Thus, new designs may 
merit more testing than proven designs. 


TRAVELING WAVE TUBE ASSEMBLIES 
Traveling Wave Tube Assembly Failures 

Ten TWTAs have failed, including six (four Ku-band and two S-band) east and west 
TWTAs on TDRS 1, three Ku-band downlink TWTAs (the third having been turned on after the 
first one failed) also on TDRS 1, and one Ku-band east TWTA on TDRS 5. The design of the 
TWTAs used on TDRS 1 was defective, resulting in heat-induced stress failures. After the early 
TWTA failures on TDRS 1, the design of the TWTAs used on the later TDRSs was improved. Of 
course, TWTA failures continued to occur on TDRS 1. 

Three of the TWTA failures occurred after operating times of less than 0.6 years, and may 
be considered to be examples of "infant mortality." Three of the failures, including the one on 
TDRS 5, occurred after operating times of about two to four years, and may be thought of as mid- 
life failures. The remaining five failures occurred after operating times of between six and nine 
years, and may be burnout failures. 

Although TWTAs have been recognized from the beginning as being among TDRS life- 
limiting components, the TWTA failure history of TDRS 1 is obviously unsatisfactory. On the 
other four satellites, each with six operating TWTAs, the expected number of failures according to 
the average MIL-HDBK 217D rate of 2.0 per million hours is 1.4. Thus, the failure of a TWTA on 
TDRS 5 is consistent with the predicted rate. Since all TWTAs have back-ups, TDRS 5 
communication service has not been affected. 
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Traveling Wave Tube Assembly Testing 

The TWTA failure experience on TDRS 1 might have been prevented by improved 
testing. Extended bum-in prior to launch might have prevented some of the "infant mortality" 
failures, but might have also reduced remaining TWTA life, thereby resulting in additional 
burnout failures. Therefore, extended bum-in of non-flight TWTA prototypes appears to be a 
better method of testing TWTA design and workmanship. 

Some analysts have expressed concerns about limited TWTA cycle life. Although 
TWTAs remain on continuously under normal circumstances, the S-band TWTAs cycle when a 
TDRS experiences a loss of signal from the ground terminal, followed by a pre-programmed 
Emergency Time-Out (ETO). In addition, solar array disorientation can lead to a low-voltage 
cutoff of K-band TWTAs. Power cycling of non-flight TWTA prototypes could help to ensure 
adequate cycle life. (Also, a better definition of cycle life could lead to design and operational 
changes that conserve power by routinely cycling TWTAs in accordance with communication 
service schedules.) 

Accelerated life testing could be performed with ambient temperatures and applied 
voltages that are more stressful than on-orbit operating conditions. This approach could have 
offered a very high likelihood of detecting design or manufacturing flaws resulting in "infant 
mortality," and a reasonable likelihood of detecting flaws leading to premature burnout. The 
accelerated life testing could incorporate both extended bum-in and power cycling. 


DIPLEXERS 
Diplexer Failures 

Two diplexers have failed, one operating in the Ku-band and one in the S-band, but both 
connected to the east antenna of TDRS 1. The cause of these failures is believed to be short 
circuiting due to the presence of metallic particle contamination in the gaps between tuning 
screws and tuning cavity walls. Manufacturing improvements made after the TDRS 1 diplexer 
failures seem to have prevented similar failures on the other TDRSs. 

The TDRS diplexer history is not satisfactory, especially because the diplexers are not 
redundant, and the failures disable the transmission of signals from the antennas. Of the two 
west diplexers remaining on TDRS 1, and the four east and west diplexers on each of the other 
four TDRSs, the expected number of additional failures at the MIL-HDBK 217D rate of 25.7 per 
billion hours is 0.02. The actual diplexer failure rate appears to have been considerably greater 
than the prediction. 

Diplexer Testing 

If the hypothesized cause of diplexer failure, weightless migration of metal particles, is 
correct, then no amount of ordinary testing on earth would have revealed the problem. Only in 
the weightlessness of orbit would the particles have floated away from the diplexer walls and 
created short circuits. Testing in a weightless environment would not be practical. Perhaps 
functional testing accompanied by rotation or vibration to mobilize contaminating particles 
would be useful to simulate some of the effects of weightlessness. However, in the case of the 
failed diplexers, a simpler solution than improved functional testing appears to be ensuring the 
adequacy of tuning gaps and maintaining and verifying cleanliness through all stages of 
manufacturing. 
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HEATERS 


Heater Failures 

Two TDRS heaters have failed, and both are located near east parametric amplifiers on 
the three-year-old satellites TDRS 1 and TDRS 4. The first failure, on TDRS 1, was attributed to a 
design flaw in which the heater was placed too close to its controlling thermostat, resulting in 
excessive cycling. The design basis was 100,000 cycles, and the failure occurred after 525,000 
cycles. The later TDRSs were modified to avoid this problem. Nevertheless, a second failure 
occurred, this time on TDRS 4. Since each TDRS has back-up heaters, and other back-up 
components that could be powered if more heat were needed, heater failures are very unlikely to 
threaten the TDRS mission. 

Heater Testing 

Heater failures resulting from a flawed design with excessive cycling might have been 
avoided if heater performance and cycling were monitored during thermal-vacuum testing or 
other thermal environment simulation, for later comparison to design data. During a simulation 
of the thermal environment, it might be necessary to include conditions representative of a TDRS 
in sunlight (in different orientations) or in eclipse, with its various "hot” payload components 
powered or off, and with its thermal control material properties (e.g., absorptivities, reflectivities, 
conductivities, and heat capacities) represented as new or after aging. In this way, any condition 
that might result in excessive heater cycling might be discovered. 


ANTENNA POINTING INDICATORS 
Antenna Pointing Indicator Failures 

After TWTAs, the components that have failed most often are parts of the gimbal drive 
electronics (GDE) used to read antenna positions. These parts are called null indicators. They 
are hermetically sealed, magnetically activated, mechanical switches with pin connectors and 
wiring. Their switching cycles are counted to determine the pitch (east-west) and roll (north- 
south) pointing positions of the east, west, and ground link antennas. Thus, there are six primary 
null indicators per TDRS, and each of these is accompanied by a back-up indicator. Another type 
of back-up exists in the form of ground station software that counts antenna movement 
commands to estimate pointing positions. 

Null indicator failures were not predicted to be highly likely. The MIL-HDBK 217D 
failure rate of each indicator is very low, only a fraction of the 203 per billion hour failure rate of 
each GDE module. The expected number of GDE failures is 0.3, only a fraction of which would 
be null indicator failures. 

Four null indicators have failed. All four failures affect pitch rather than roll indicators. 
Two of the failures are in the primary and back-up null indicators of the east antenna drive of 
TDRS 1. The other two failures are in the primary and back-up null indicators of the west 
antenna drive of TDRS 4. The times in service of the failed indicators were 0.00, 1.40, 2.23, and 
6.49 years. The occurrence of the four failures in two primary/back-up pairs is remarkable for its 
random probability, based on the TDRS age distribution, of about 0.02. However, the pairings 
are unexplained, and convincing explanations of the failures are lacking. 
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Antenna Pointing Indicator Testing 


The apparently high rate of defects in the null indicators makes them good candidates for 
improved testing. On the other hand, the absence of an understanding of the cause of failure 
makes test specification problematical. The occurrence of the failures in primary /back-up pairs 
seems to indicate that the cause of the failures is in the design or environment of the switch pair, 
not internal to the switches. Thus far, ground testing of similar null switches under conditions 
somewhat representative of on-orbit operations has not resulted in a failure. 

Test environment modifications that might appear to offer some possibility of 
reproducing the on-orbit failures include testing with thermal cycling, ionizing radiation, and, as 
in the case of the diplexers discussed above, rotation or vibration. Accelerated life testing of 
prototype null indicators, in which pertinent environmental factors are exaggerated, might also 
prove to be useful. 


GYRO 
Gyro Failure 

The four TDRS 1 gyros were operated extensively to recover from a booster rocket failure 
during launch. One gyro failed three months later. Although each gyro exceeded its estimated 
1500-hour design life by 1200 hours, the failure is counted in accordance with the criteria of this 
paper. Since each of the other three gyros continues to operate far beyond the design life (with 
current accumulated times in operation averaging 3900 hours), the failed gyro was probably 
defective rather than worn out. 

The possibility remains that this failure at least in part is attributable to the failure of the 
booster rocket, not to TDRS 1 itself. However, this consideration is offset by the possibility that 
the uncounted thruster failures may not be entirely attributable to the booster rocket failure. In 
any case, since the very early gyro failure, no failures have occurred among either the three 
remaining gyros on TDRS 1 or any of the four gyros (some of which have logged almost 2000 
operating hours) on each of the other four TDRSs in orbit 

Gyro Testing 

Any recommendation for additional gyro testing should account for gyro failure history. 
The TDRS gyro history is excellent, especially because each TDRS's long-term mission requires 
only one gyro. At the MIL-HDBK 217D failure? rate of 2.06 per million hours, in the 26.3 TDRS- 
years of experience the expected number of additional failures is nine gyros, or an average of two 
per TDRS. Since none of these failures have occurred, the actual failure rate appears to be 
considerably lower. On the basis of on this experience, no additional testing of gyros is 
recommended. 


OTHER COMPONENTS 
Other Failures 

The other TDRS components that have failed include the following: 

Phased array receiver, S-band, primary (#10) on TDRS 1 at an age of six years (cause 
unknown) 
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Synthesizer, S-band return east, primary, on TDRS 1 at an age of six years (cause 
unknown) 

West polarization switch stuck on TDRS 3 at an age of one year (caused by a short 
circuit, possibly related to thermal cycling, with insulation shrinkage and exposure of 
underlying wire) 

Earth sensor electronics (ESE), primary, on TDRS 4 at an age of two years (cause 
unknown) 

Master frequency generator (MFG), 955 megahertz output, primary lost on TDRS 4 at an 
age of two years (cause unknown) 

Processor, S-band return east, primary (or possibly frequency synthesizer, S-band return 
east, back-up) on TDRS 1 at an age of eight years (cause unknown) 

Thermistor on solar array of TDRS 6 during launch or deployment (caused by de- 
bonding) 

The MIL-HDBK failure rates of these components are neither remarkably high nor low. The 
failures appear to be isolated and individually unpredictable events whose further description 
would not be useful here. 

Unfailed Component Types 

All other components are unfailed. Interestingly, these include the TT&C transponders, 
encrypters, and decrypters, which are predicted to be TDRS reliability drivers. At the MIL-HDBK 
217D failure rate of 14.5 per million hours, the total number of expected failures is 3.34. The 
probability of no failures when 3.34 are expected is 0.0354. Perhaps the unexpectedly good 
experience with the TT&C subsystem is attributable to its extensive early development, testing, 
and pre-launch operation. 

Other Component Testing 

The predicted failure rates of other components do not appear to be particularly useful 
for planning a testing program. No additional testing of these components is recommended. 


CONCLUSIONS 

The overall TDRS component failure history is consistent with high quality in design and 
workmanship, and with the total predicted failure rate from MIL-HDBK 217D. The philosophy 
of extensive redundancy combined with pre-launch performance and thermal-vacuum testing 
has been sufficient to ensure the continuous long-term availability of Space Network 
communication service. 

Specific failures do not appear to have been predictable using MIL-HDBK methods. The 
types of components predicted to fail have not been the same as those that actually failed. 
Subsystems with extensive heritage have been much more reliable than predicted. Some new 
and modified payload components on TDRS 1 have been less reliable than predicted. However, 
the TDRS 1 failures led to design and manufacturing improvements on later TDRSs, whose 
reliabilities have been much better. 
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The principal components with an unsatisfactory failure history are the TWTAs on TDRS 

1. These TWTAs have appeared to be subject to design error, resulting in both "infant mortality" 
and premature burnout. Their failures on orbit might have been avoided through sufficient 
accelerated life testing of prototypes, with both extended bum-in and power cycling. Without 
this testing, TDRS 1 failures had to occur before the TWTAs on later TDRSs could be targeted for 
improvement. The reliability of the improved TWTAs has been satisfactory. 

The diplexer failure history presents an interesting testing challenge in which the 
migration of contaminating metallic particles in a weightless environment would need to be 
simulated. One approach could be the imposition of rotation or vibration during testing. 

Accelerated life testing, rotation, or vibration might also be applied beneficially to 
antenna pointing indicators in order to determine the cause of their failures. 

In the case of heaters, an accurate simulation of variations in on-orbit thermal conditions 
accompanied by monitoring of cycling rates might have prevented failures. 

The TDRS reliability history appears to confirm the long-held view that additional testing 
can prevent on-orbit failures. Testing is particularly important for new and modified systems, 
subsystems, and components. From the failures experienced, it seems that accelerated life testing 
of prototypes including extended burn-in, cycling of applied power and ambient temperature, 
and rotation or vibration should receive especially strong consideration during the development 
of new spacecraft. However, identifying the types of components that merit more testing, and 
quantifying test conditions and durations so that they are consistent with procurement budgets 
and schedules, remain as major problems. 
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